Legal notice: The Norwegian version is legally authoritative. This English translation is provided for convenience.
Version 2026-09-06 — last updated 6 September 2026
SMkino is provided by Chavez Konsult Sergio Arturo Chavez Rosales (sole proprietorship), Norwegian organisation no. 923 941 010, trading as Optimaized.
Brennrud 19, 2500 Tynset, Norway
Registered in the Norwegian Central Coordinating Register for Legal Entities (Enhetsregisteret)
Email: sergio@optimaized.io
The role depends on the processing purpose:
| Category | Information | Purpose |
|---|---|---|
| Account and contact | Name, email address, profile picture, role, cinema association and sign-in time | Sign-in, access control, contract, support and security |
| Cinema and content data | Film programme, auditoriums, capacity, aggregated sales, posts, media, routines and publishing history | Generate, schedule, publish and analyse marketing |
| Operator content | Free text in feedback, AI chat and instructions, and conversation history | Regenerate posts and provide the AI assistant |
| Integrations | Encrypted OAuth tokens and social-account identifiers | Publish on the cinema's behalf |
| Payment | Stripe customer and subscription identifiers, status and invoice information. SMkino does not store card details. | Subscription, payment and accounting follow-up |
| Technical data | IP address and user agent when terms/privacy are accepted, timestamps, operational errors and relevant tenant/cinema identifiers | Document acceptance, secure the service and troubleshoot |
Ticket-sales imports are aggregated rather than individual. The service is not intended for guest personal data. Operators must avoid uploading it; free text and media may nevertheless contain personal data and are handled on the cinema's instructions.
| Purpose | Role | Legal basis |
|---|---|---|
| Account, access, contract and subscription | Controller | Contract (GDPR Art. 6(1)(b)) where the individual is a party to the contract. For cinema employees and representatives: legitimate interests (Art. 6(1)(f)) in administering the customer relationship and providing secure authorised access. |
| Security, troubleshooting and evidence of acceptance | Controller | Legitimate interests (Art. 6(1)(f)) and, when applicable, legal obligation (Art. 6(1)(c)) |
| Cinema content, integrations and AI processing | Processor | The cinema determines the legal basis; Chavez Konsult follows documented instructions |
The active AI provider is Anthropic (Claude). Depending on the feature, it receives film and screening data, the full post being improved, the operator's free-text feedback, chat messages and relevant conversation history, an aggregated cinema/tenant digest, and results from tools used by the assistant. Free text may be personal data if the operator enters such information.
SMkino provides and manages the AI service. OpenAI (including proposed audio transcription) and Google Gemini are not active or approved under this notice. Activation requires verified supplier terms and transfer safeguards, updated information and the advance notice and objection procedure in the DPA. Resend email delivery is likewise not active; any activation must first meet the applicable supplier and notice requirements.
Operators must not enter special-category data, confidential personal data or information about cinema guests in free-text fields.
| Service | Purpose and data | Region / transfer basis |
|---|---|---|
| Supabase | System of record: Postgres database, authentication and storage | AWS eu-central-1, Frankfurt (EU/EEA) |
| Vercel | The entire API, server functions, frontend and CDN; processes requests and service data | API compute is configured for arn1, Stockholm. The CDN is global. Transfers outside the EEA are governed by Vercel's DPA and SCCs where required. |
| Anthropic (Claude) | AI generation and agent chat with the data described in section 4 | United States; a DPA and valid transfer basis are required; account agreements must be verified |
| Sentry | Error tracking with operational errors and relevant tenant identifiers, not activated | The account region cannot be verified from the codebase; a DPA/SCCs are required for transfers outside the EEA |
| Domeneshop | SMTP for operational and health alerts; recipient address, error text and possible tenant identifiers, not activated | Norwegian provider; Domeneshop's data processing agreement and current sub-processor list apply |
| Stripe | Payments and subscriptions: contact, cinema, subscription and invoice data | EU/United States; the applicable transfer basis must be verified |
| OAuth sign-in: authentication and basic profile information | EU/United States; provider transfer basis | |
| Meta, Snapchat and TikTok | Publishing to accounts connected by the cinema; posts and media | EU/United States; platform terms and SCCs/another valid basis where required |
| DX Cinema API and Film- og Medieserver | Cinema programme, aggregated ticket sales and marketing assets | Norway/EEA |
Important information about Vercel: API compute in Stockholm was verified on 6 September 2026. Global CDN, support and other providers may still involve transfers outside the EEA. Supplier agreements and applicable transfer safeguards must be verified for the account; an EU region alone is not evidence of those agreements. Contact us for relevant safeguards and a copy where applicable.
Personal data is not sold.
Uploaded publishing media is stored at publicly retrievable URLs so social platforms can fetch it. Anyone with a URL can retrieve that file, including before publication. Do not upload private or confidential material; the cinema must check publishing rights and any embargo before uploading.
| Data type | Retention |
|---|---|
| Account and customer data | While the customer relationship or user account is active, and then for as long as law or contract requires. Accounts can be deleted under Settings → Privacy. |
| Agent chat | Up to 90 days. |
| Social-media tokens | While the connection is active; deleted on disconnection or account deletion. |
| IP address and user agent in the acceptance log | No longer than the life of the user account. When the user is deleted, a database trigger automatically anonymises the IP address and user agent, while the acceptance record may be retained without those identifiers as evidence. |
| Payment and accounting data | In accordance with Stripe's rules and statutory accounting requirements. |
Cancelling a paid subscription moves the cinema to Free and does not end the agreement or trigger deletion. On termination of the agreement, personal data processed for the cinema is deleted within 30 days unless law requires retention. You may request an export before deletion. See the deletion guide.
Where Chavez Konsult is the controller, you may request access, rectification, erasure, restriction, objection and portability when the relevant conditions are met. Where Chavez Konsult is a processor, requests should normally be addressed to the cinema, and we assist the cinema under the DPA.
Contact sergio@optimaized.io. You may lodge a complaint with the Norwegian Data Protection Authority.
SMkino uses no tracking or marketing cookies. The sign-in token is stored in browser localStorage and is technically necessary for signed-in functionality. Google OAuth may set its own cookies during sign-in. Optional product analytics (Plausible) is disabled. It will not be reactivated without a supplier and device-access assessment and, where required, prior consent.
Registered users will be notified of material changes by email or in the service. The date above identifies the applicable version.
Standard data processing agreement: open the DPA.
SMkino is provided by Chavez Konsult Sergio Arturo Chavez Rosales (sole proprietorship), Norwegian organisation no. 923 941 010, trading as Optimaized · Brennrud 19, 2500 Tynset, Norway · sergio@optimaized.io